Splunk Enterprise Vulnerability: Arbitrary JavaScript Code Execution in Browser Context

CVE-2024-36997

Summary

In specific versions of Splunk Enterprise and Splunk Cloud Platform, an admin user may exploit a vulnerability to inject and execute arbitrary JavaScript in another user's browser session. This occurs through the conf-web/settings REST endpoint. The vulnerability allows attackers to carry out persistent cross-site scripting attacks, posing risks to sensitive data and user sessions. It is crucial for users of affected versions to update and secure their systems against possible exploitation.

References